Connecting a pvlan switch to a non-pvlan device

ABSTRACT

A PVLAN switch for connecting a PVLAN to a non-PVLAN device is configured as a primary VLAN with secondary VLANs, the primary VLAN includes promiscuous ports, each of the secondary VLANs includes a smart PVLAN trunk port, and the smart PVLAN trunk port is included in at least two secondary VLANs where the smart PVLAN trunk port and the promiscuous port connect to non-PVLAN devices. A frame is received on a smart PVLAN trunk port sent from a non-PVLAN device, and includes a destination address and a secondary VLAN ID. The PVLAN switch port ID for the first frame, and a primary VLAN ID for the secondary VLAN ID are identified. If the frame is a non-isolated port, the secondary VLAN ID is modified to be the primary VLAN ID, and the modified frame is sent to another non-PVLAN device connected to the PVLAN switch port.

BACKGROUND

The present invention relates to computer networks, particularly toprivate virtual local area networks (PVLAN), and more particularly, to aPVLAN switch and method of its connecting to a non-PVLAN device.

As known in the field of computer network, a single Layer Two (L2)network, may be partitioned into a plurality of broadcast domains whichare isolated from each other, so that data frames may be transferredbetween them only via one or more routers. Such a domain is called avirtual local area network (VLAN). Currently the most common protocolfor configuring a VLAN is IEEE 802.1Q, according to which each Ethernetframe is added with a VLAN tag, which includes the identification (ID)of the VLAN to which the frame belongs, so that devices such as switchesmay determine the VLAN to which the frame belongs according to the VLANID.

PVLAN is a VLAN-based computer networking technology for implementingcommunication isolation among ports. PVLAN relates to several conceptsand understanding these concepts will facility better understanding ofthe present invention. The following will introduce the involvedconcepts one by one.

PVLAN includes three different types of sub-VLANs, which are primaryVLANs, community VLANs, and isolated VLANs. Community VLANs and isolatedVLANs are collectively called secondary VLANs. In the three types ofVLANs included in a PVLAN, one of the VLANs may communicate with all theother VLANs, and it is called a primary VLAN. Usually the primary VLANmay also be used to represent the entire PVLAN. If all the ports in aVLAN may communicate with each other and also communicate with a port inthe primary VLAN, this VLAN is called a community VLAN. If all the portsin a VLAN cannot communicate with each other and may only communicatewith a port in the primary VLAN, this VLAN is called an isolated VLAN.In a PVLAN, a community VLAN and an isolated VLAN are subordinate to theprimary VLAN, or in other words, the community VLAN and the isolatedVLAN are related to the primary VLAN. This is the reason why thecommunity VLAN and the isolated VLAN are called secondary VLANs.

The ports included in a primary VLAN are called promiscuous ports, whichare usually connected to uplink routers, firewalls and servers. Theports included in a community VLAN are called community ports. The portsincluded in an isolated VLAN are called isolated ports. Community portsand isolated ports are also called host ports, because these ports areusually connected to downlink hosts. A PVLAN switch may include severalpromiscuous ports, several community ports and several isolated ports.

The communication isolation rules in a PVLAN are as follows:

1) The promiscuous ports may communicate with all the community portsand isolated ports.

2) The community ports may communicate with all the ports in the samecommunity VLAN, and may also communicate with the promiscuous ports.However, they cannot communicate with the ports in a different communityVLAN.

3) The isolated ports may only communicate with the promiscuous ports.

According to the above rules, flows may be isolated within the switch.

When ports are in a plurality of VLANs simultaneously, they are calledtrunk ports. That is, promiscuous ports simultaneously in a plurality ofprimary VLANs are called trunk promiscuous ports; community portssimultaneously in a plurality of community VLANs are called trunkcommunity ports; isolated ports simultaneously in a plurality ofisolated VLANs are called trunk isolated ports; and trunk communityports and trunk isolated ports are also collectively called trunk hostports.

In the present invention, references to promiscuous ports, communityports, isolated ports, trunk promiscuous ports, trunk community ports,and trunk isolated ports are meant to be PVLAN promiscuous ports, PVLANcommunity ports, PVLAN isolated ports, PVLAN trunk promiscuous ports,PVLAN trunk community ports, and PVLAN trunk isolated ports. Theomission of the prefix PVLAN is only for convenience.

Currently there are two types of PVLAN trunk ports, i.e., theabove-mentioned PVLAN trunk promiscuous ports and PVLAN trunk isolatedports. When a frame from a PVLAN trunk isolated port is to betransmitted from a PVLAN trunk promiscuous port, the 802.1Q tag of theframe will be rewritten with a proper primary VLAN ID. When a PVLANtrunk promiscuous port receives a frame from the primary VLAN, the802.1Q tag of the primary VLAN ID carried by the frame will bere-written with the isolated VLAN ID.

Thus a PVLAN trunk promiscuous port may simultaneously transmitinformation from a plurality of primary VLANs from the PVLAN switch to anon-PVLAN device, and a PVLAN isolated port may simultaneously transmitinformation from a plurality of isolated VLANs to a non-PVLAN device.However, the two current PVLAN trunk ports cannot simultaneouslytransmit information from a plurality of community VLAN from the PVLANswitch to a non-PVLAN device.

It can be seen that an improved PVLAN switch and a method of itsconnecting to a non-PVLAN device may be advantageous in the field, sothat during deployment, even if the PVLAN switch is connected to anon-PVLAN device, community VLAN information may be transmitted from thePVLAN switch to the non-PVLAN device.

SUMMARY

Embodiments of the present invention disclose a method and PVLAN switchfor connecting a private virtual local area network PVLAN switch to anon-PVLAN device, where the PVLAN switch is configured as a primary VLANwith at least two secondary VLANs related to the primary VLAN, theprimary VLAN includes at least one promiscuous port, each of the atleast two secondary VLANs includes at least one smart PVLAN trunk port,and the at least one smart PVLAN trunk port is included in at least twosecondary VLANs wherein the smart PVLAN trunk port and the promiscuousport are for connecting non-PVLAN devices. A first frame is received ona smart PVLAN trunk port sent from a non-PVLAN device connected to thesmart PVLAN trunk port, the first frame including a destination addressand a secondary VLAN ID. Based on the destination address of the firstframe, the PVLAN switch port ID corresponding to the first frame, andthe primary VLAN ID related to the secondary VLAN ID are identified. Inresponse to determining that the PVLAN switch port corresponding to thefirst frame is a non-isolated port, the secondary VLAN ID in the firstframe is modified to be the primary VLAN ID related to the secondaryVLAN, and the modified first frame is sent to another non-PVLAN deviceconnected to the PVLAN switch port corresponding to the first frame fromthe PVLAN switch port corresponding to the first frame.

The solutions according to embodiments of the present invention mayconnect information from all types of secondary VLANs, includingisolated secondary VLANs and the community secondary VLANs, from thePVLAN switch to non-PVLAN devices.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The above and other objects, features and advantages of the presentdisclosure will become more apparent through the more detaileddescription of embodiments of the present disclosure in conjunction withthe accompanying drawings, wherein like reference numerals generallyrefers to like components in the embodiments of the present disclosure.

FIG. 1 shows an exemplary virtualized environment in which the PVLANswitch according to an embodiment of the present invention operates.

FIG. 2 shows a flow of a method for connecting a PVLAN switch to anon-PVLAN switch according to an embodiment of the present invention.

FIG. 3 exemplarily and schematically shows an improved MAC addresslearning process of the PVLAN switch according to an embodiment of thepresent invention.

FIG. 4 shows an improved frame forwarding process of the PVLAN switchaccording to an embodiment of the present invention.

FIG. 5 schematically shows default entries for PVLAN and the use thereofin the forwarding process according to an embodiment of the presentinvention.

FIG. 6 shows a schematically structural diagram of a PVLAN switchaccording to an embodiment of the present invention.

DETAILED DESCRIPTION

FIG. 1 is a functional block diagram illustrating a distributed dataprocessing environment 100, in accordance with an embodiment of thepresent invention.

Some preferred embodiments will be described in more detail withreference to the accompanying drawings, in which the preferredembodiments of the present disclosure have been illustrated. However,the present disclosure can be implemented in various manners, and thusshould not be construed to be limited to the embodiments disclosedherein. On the contrary, those embodiments are provided for a thoroughand complete understanding of the present disclosure, and for completelyconveying the scope of the present disclosure to those skilled in theart.

In order to solve the technical problem presented in the background art,the present invention defines a smart PVLAN trunk port. The port can notonly transfer community VLAN information from the PVLAN switch to anon-PVLAN device, but also transfer information from an isolated VLANand a community VLAN to a non-PVLAN device. That is, the smart PVLANtrunk port may only belong to a plurality of community VLANs, or belongto a plurality of community VLANs and isolated VLANs simultaneously.

Referring to FIG. 1, an exemplary virtualized environment is shown inwhich the PVLAN switch according to an embodiment of the presentinvention operates. As shown, the PVLAN switch has a promiscuous portP3, and two smart PVLAN trunk ports P1 and P2. The promiscuous port P3is connected to a gateway (a non-PVLAN device), and the two smart PVLANtrunk ports are connected to non-PVLAN switches 1 and 2 respectively;the non-PVLAN switches 1 and 2 may be two virtual switches. The virtualswitches are located at the hypervisors on two physical serversrespectively. It should be noted that the virtual switch used here ismerely an application scenario, and is not restriction of the presentinvention. The non-PVLAN switch 1 is connected to virtual machines VM1,VM2, and VM3; the non-PVLAN switch 2 is connected to virtual machinesVM4, VM5, and VM6. On the PVLAN switch are configured a primary VLAN100, and community secondary VLAN 101 and isolated secondary VLAN 102.Virtual machines VM1, VM2 and VM4 are included in the communitysecondary VLAN 101, and here are assumed to belong to company A, so thatthey can communicate with each other; virtual machines VM3, VM5 and VM6are included in the isolated secondary VLAN 102, and here are assumed tobelong to companies A, B, and C respectively, so that they cannotcommunicate with each other. It can be seen that the community secondaryVLAN 101 and the isolated secondary VLAN 102 both cross a non-PVLANswitch (the non-PVLAN switch 1 and non-PVLAN switch 2), and eachnon-PVLAN switch is related to the two secondary VLANs (community VLAN101 and isolated VLAN 102), so that each smart PVLAN trunk port andtheir links will transfer the frames of the two secondary VLANs.Similarly, here virtual machines VM can also be other physical hosts.

If there is no smart PVLAN trunk port proposed by the present invention,P1 and P2 in FIG. 1 are merely ordinary trunk ports, then VLAN 101 whereVM1 and VM2 are located and VLAN 102 where VM3 is located need two linksto be connected to the PVLAN switch, and the PVLAN needs two ports;similarly, VLAN 101 where VM4 and VM5 are located and VLAN 102 where VM6is located also need two links to be connected to the PVLAN switch, andthe PVLAN further needs two ports, so the PVLAN switch needs 4 ports intotal. The smart PVLAN trunk ports introduced by the present inventionmay reduce the number of links and ports used in communication of thePVLAN switch.

Those skilled in the art may appreciate that the above described andillustrated PVLAN switch and its operation environment according to theembodiment of the present invention are merely exemplary, rather thanlimitation to the present invention. For example, the PVLAN switch mayalso be configured with other promiscuous ports or trunk promiscuousport, and correspondingly, may be configured with other primary VLANs.The PVLAN switch may also be configured with any other number and typesof secondary VLANs. The PVLAN switch may be configured with any othernumber and types of community ports, trunk community ports, isolationports, trunk isolation ports (additionally, the PVLAN switch may also beconfigured with trunk ports for connecting to other PVLAN switches, andconfigured with ordinary VLAN ports outside of PVLAN). The PVLAN switchmay connect to any other number of other non-PVLAN switches, and eachnon-PVLAN switch may connect to any other number of VMs, and the VMs maybe divided into any secondary VLAN.

In summary, the improvement of the PVLAN switch according to the presentinvention mainly lies in the tag rewriting executed by its smart PVLANtrunk port: the smart PVLAN trunk port may smartly rewrite the VLAN tagin the frame before sending the frame.

FIG. 2 shows the flow of a method of connecting a PVLAN switch to anon-PVLAN device according to an embodiment of the present invention,wherein the PVLAN switch is configured as a primary VLAN and at leasttwo secondary VLANs related to the primary VLAN, and the primary VLANincludes at least one promiscuous port, and each of the at least twosecondary VLANs includes at least one smart PVLAN trunk port, which isincluded in at least two secondary VLANs, wherein the smart PVLAN trunkport and the promiscuous port are for connecting non-PVLAN devices.

According to FIG. 2, the method comprises:

At step S201, receive a first frame on a smart PVLAN trunk port sentfrom the non-PVLAN device connected to the smart PVLAN trunk port.

At step S203, in response to that the first frame includes the secondaryVLAN ID, the PVLAN switch port ID corresponding to the first frame andthe primary VLAN ID related to the secondary VLAN ID included in thefirst frame can be obtained based on the destination address of thefirst frame, and the PVLAN switch port corresponding to the first frameis a non-isolated port: modify the secondary VLAN ID in the first frameinto the primary VLAN ID related to the secondary VLAN ID; and send themodified first frame to the non-PVLAN device connected to the PVLANswitch port corresponding to the first frame from the PVLAN switch portcorresponding to the first frame.

According to an embodiment of the present invention, the non-isolatedport is one of: a promiscuous port; and a smart PVLAN trunk port.

In a preferred embodiment of the present invention, the method furthercomprises step S202 (not shown in FIG. 2) to store the source address ofthe first frame, the secondary VLAN ID and its related primary VLAN ID,and the PVLAN switch port ID corresponding to the first frame. This stepmay be performed before or after step S203. In fact, this is an addresslearning process of the PVLAN switch. Those skilled in the art may knowthat if the source address of the first frame, the secondary VLAN ID andits related primary VLAN ID and the PVLAN switch port ID correspondingto the first frame have been stored, then the learning process may beomitted. In addition, those skilled in the art may also know that herethe source address and the destination address of the frame may be MACaddresses or IP addresses, or any unique addresses defined in thenetwork. The following description takes MAC addresses as example.

Referring to FIG. 3, it exemplarily and schematically shows the improvedMAC address learning process of the PVLAN switch according to anembodiment of the present invention.

As the example shown in FIGS. 1, P1 and P2 ports of the PVLAN switch areboth smart PVLAN trunk ports according to an embodiment of the presentinvention, each smart PVLAN trunk port may connect to a plurality ofcommunity secondary VLANs (e.g., VLAN 101) and/or isolated secondaryVLANs (e.g., VLAN 102). For a community secondary VLAN (e.g., VLAN 101)connected to a smart PVLAN trunk port (e.g., P1), its traffic may beforwarded to a promiscuous port (e.g., p3), and other smart PVLAN trunkports (e.g., P2) belonging to the community secondary VLAN. For anisolated secondary VLAN (e.g., VLAN 102) connected to a smart PVLANtrunk port (e.g., P1), its traffic may only be forwarded to thepromiscuous port (e.g., P3).

In embodiments of the present invention, the PVLAN switch usually use aMAC address table to store the MAC address, VLAN ID, and port ID. Thoseskilled in the art know that other mapping relationships, e.g., arraysand linked list, may also be used to store them. Here the MAC addresstable in the PVLAN switch is improved. As can be known by those skilledin the art, the MAC address table is part of the MAC learning mechanismof the PVLAN switch, and it stores the mapping relationships between thesource MAC address extracted from the received frame, the ID of the VLANto which the frame belongs and the receive port for future frameforwarding.

The structure of a traditional MAC address table is as shown in Table 1:

TABLE 1 MAC address VLAN ID Port IDwherein the MAC address column is for storing the source MAC address ofthe received frame, the VLAN ID column is for storing the ID of the VLANto which the frame belongs, and the port ID column is for storing theport receiving the frame.

The structure of the MAC address table improved according to anembodiment of the present invention is as shown in Table 2:

TABLE 2 MAC address VLAN ID Port ID Original VLAN ID

It can be seen that compared with the traditional MAC address table, anoriginal VLAN ID column is added in the improved MAC address table. Ifthe smart PVLAN trunk port receives a frame, then the ID of the primaryVLAN is stored in the VLAN ID column, and the ID of the secondary VLANto which the frame belongs is stored in the original VLAN ID column; ifa frame is received on a promiscuous port, then the ID of the primaryVLAN to which the frame belongs is stored in both the VLAN ID column andthe original VLAN ID column.

As shown in FIG. 3, the PVLAN switch receives a frame from the non-PVLANswitch 1 on the smart PVLAN trunk port P1, the frame having adestination MAC address A, source MAC address B, and VLAN ID 101, andthe MAC address leaning mechanism in the PVLAN switch obtains the sourceMAC address B of the frame, the ID 100 of the primary VLAN to which theframe belongs, the receive port number P1 of the frame, and the ID 101of the secondary VLAN to which the frame originally belongs, and insertsthem into the MAC address table, i.e., Table 3, as an entry. The entrymay be used for future frame forwarding.

TABLE 3 MAC address VLAN ID Port ID Original VLAN ID B 100 P1 101

Assuming previously a frame sent to a community secondary VLAN (e.g.,VLAN 101) and/or an isolated secondary VLAN (e.g., VLAN 102) from thesmart PVLAN trunk port P1 was received on the promiscuous port, and thedestination MAC address of the frame was B, its source MAC address wasA, its VLAN ID was 100, the MAC address learning mechanism in the PVLANswitch obtained the source MAC address A of the frame, the ID 100 of theprimary VLAN to which the frame belongs, the receive port number P3 ofthe frame, and the primary VLAN ID of the frame which was also 100, andinserted them into the MAC address table, i.e., Table 4, as an entry.

TABLE 4 MAC address VLAN ID Port ID Original VLAN ID A 100 P3 100

Then for the frame sent to the promiscuous port P3 and including thesecondary VLAN ID with the destination MAC address A, the source MACaddress B, the VLAN ID 101, at step S203, the address table is queriedaccording to the destination MAC address to get the primary VLAN ID 100corresponding to the secondary VLAN ID 101, and the VLAN ID of the frameis modified as 100 corresponding to the VLAN ID in the address table,and then it is sent to port P3 corresponding to the port ID in theaddress table.

In an embodiment, the method shown in FIG. 2 further comprises: at stepS205 (not shown in FIG. 2), receiving a second frame on a promiscuousport sent by the non-PVLAN device connected to the promiscuous port; atstep S207 (not shown in FIG. 2), in response to that the second framecomprises a primary VLAN ID, the PVLAN switch port ID corresponding tothe second frame and the secondary VLAN ID related to the primary VLANID can be obtained based on the destination address of the second frame,and the PVLAN switch port corresponding to the second frame is one of: apromiscuous port; and a smart PVLAN trunk port: modifying the primaryVLAN ID in the second frame into a secondary VLAN ID related to thesecond frame; and sending the modified second frame to the non-PVLANdevice connected to the PVLAN switch port corresponding to the secondframe from the PVLAN switch port corresponding to the second frame.

In a preferred embodiment, the method shown in FIG. 2 further comprisesstep S206 (not shown), to store the source address of the frame of theprimary VLAN ID of the second frame, the primary VLAN ID and its relatedsecondary VLAN ID, and the PVLAN switch port ID corresponding to thesecond frame. In fact, this step may be performed before or after stepS207. This is an address learning process of the PVLAN switch. Thelearning results are as shown in Table 4. Those skilled in the art mayknow that if the source address of the frame of the primary VLAN ID ofthe second frame, the primary VLAN ID and its related secondary VLAN ID,and the PVLAN switch port ID corresponding to the second frame have beenstored, then this step may be omitted. As can be known from the examplethat the MAC address in the MAC address table corresponds to the sourceMAC address of the sent frame used during learning, and the destinationMAC address of the sent frame during querying.

Now referring to FIG. 4, it shows the improved frame forwarding processof the PVLAN switch according to an embodiment of the present invention.As shown, when the PVLAN switch receives a frame with a destination MACaddress B, source MAC address A, VLAN ID 100 on a promiscuous port P3,the PVLAN switch will look up the corresponding entry in the MAC addresstable, i.e., Table 3, according to the destination MAC address B andVLAN ID 100 of the frame, so as to get the send port P1 of the frame andthe ID 101 of the primary VLAN, that is, the secondary VLAN ID relatedto the primary VLAN ID 100. Then, the PVLAN switch will use ID 101 ofthe found primary VLAN to rewrite VLAN ID 100 in the VLAN ID of theframe, and send the rewritten frame from the port ID in Table 3, i.e.,P1.

FIG. 2 is a cross process, where the learning results of the smart PVLANtrunk port are queried by the promiscuous port, and the learning resultsof the promiscuous port are queried by the smart PVLAN trunk port.

Above is described the improved MAC address learning and forwardingprocess of frames transmitted between a smart PVLAN trunk port and apromiscuous port of the PVLAN switch according to an embodiment of thepresent invention. The MAC address learning process and forwardingprocess of frames transmitted between two smart PVLAN trunk ports of thePVLAN switch (i.e., transmitted in the same secondary VLAN) is the sameas described above, and is omitted here.

In an embodiment, the method shown in FIG. 2 further comprises step S204(not shown): in response to that the first frame comprises a secondaryVLAN ID, and the primary VLAN ID corresponding to the secondary VLAN IDcannot be obtained based on the destination address of the first frame(e.g., the learning process has not yet happened, i.e., Table 3 or Table4 has not yet existed), using a default entry to process.

In an embodiment, the method shown in FIG. 2 further includes step S208(not shown): in response to that the second frame includes the primaryVLAN ID, and that the secondary VLAN ID related to the primary VLAN IDcannot be obtained according to the destination address of the secondframe, using the default entry to process.

In an embodiment, the method shown in FIG. 2 further comprises step S209(not shown): in response to that the received frame is a broadcastframe, using a default entry to process, wherein the received frame isone of: the first frame; and the second frame.

Now refer to FIG. 5 to explain default entries.

FIG. 5 schematically shows the default entry for the PVLAN and its usesduring the forwarding process according to an embodiment of the presentinvention, the default entry being suitable for the primary VLAN and allthe secondary VLANs in the PVLAN. As shown, the default entry is storedin the MAC address table, and there is a default entry for each PVLAN.For example, for PVLAN 100 (as introduced in the Background of theInvention part, the primary VLAN ID is used to represent the PVLAN), inthe MAC address table, there are an entry for the promiscuous port P3and primary VLAN 100, an entry for the smart PVLAN trunk port P1 andsecondary VLAN 101, an entry for the smart PVLAN trunk port P2 andsecondary VLAN 101, an entry for the smart PVLAN trunk port P1 andsecondary VLAN 102, and an entry for the smart trunk port P2 andsecondary VLAN 102. In an embodiment, these entries belong to thedefault entry PVLAN 100, and each entry is an option. Thus, when abroadcast frame belonging to the primary VLAN 100 or a frame for which amatching entry cannot be found in the MAC address table is received onthe promiscuous port P3, the default entry will be hit. As shown in FIG.5, the default entry include a plurality of options, and a copy of theframe will be generated for each option, and the VLAN ID in the copy ismodified as the rewritten VLAN ID in the corresponding option, and themodified copy will be sent from the PVLAN switch port designated in thecorresponding option. For example, ID 101 of the secondary VLAN is usedto rewrite ID 100 of the primary VLAN in the copy, and the copy is sentfrom port P1; ID 101 in the secondary VLAN is used to rewrite ID 100 ofthe primary VLAN in the copy, and the copy is sent from port P2; ID 102in the secondary VLAN is used to rewrite ID 100 of the primary VLAN inthe copy, and the copy is sent from port P1; ID 102 of the secondaryVLAN is used to rewrite ID 100 of the primary VLAN in the copy, and thecopy is sent from port P2. Here the copy of P3 in VLAN 100 is not made,because the frame per se is received on port P3, and according to thecurrent technique, the copy should not be sent from P3 again. This isthe prior art, and is pointed out for better understanding.

These default entries may be automatically generated and updated whenthe user configures related contents of the PVLAN (e.g., creating ordeleting the secondary VLANs or the primary VLAN, adding or deleting aVLAN from the VLANs).

Above is described the flow of a method of connecting PVLAN switch to anon-PVLAN device according to an embodiment of the present inventionwith reference to the accompanying drawings. It should be pointed outthat the above description is merely exemplary, rather than limitationto the present invention. In addition, as those skilled in the art mayappreciate, the above description actually also discloses a PVLANswitch. In the following, referring to FIG. 6, it shows an exemplarystructural diagram of a PVLAN switch according to an embodiment of thepresent invention, and for the more detailed contents of the PVLANswitch, reference may be made to the above description.

According to the embodiment of the present invention, the PVLAN switch600 is configured as a primary VLAN and at least two secondary VLANsrelated to the primary VLAN, the primary VLAN comprises at least onepromiscuous port, each of the at least two secondary VLANs comprises atleast one smart PVLAN trunk port, and the smart PVLAN trunk port isincluded in the at least two secondary VLANs, wherein the smart PVLANtrunk port and the promiscuous port are for connecting the non-PVLANdevice. As shown in FIG. 6, the PVLAN switch 600 comprises: receivingmeans 601 configured to receive a first frame on a smart PVLAN trunkport sent from a non-PVLAN device connected to the smart PVLAN trunkport; in response to that the first frame comprises the secondary VLANID, the PVLAN switch port ID corresponding to the first frame and theprimary VLAN ID related to the secondary VLAN ID included in the firstframe can be obtained based on the destination address of the firstframe, and the PVLAN switch port corresponding to the first frame is anon-isolated port; modifying means 602 configured to modify thesecondary VLAN ID in the first frame into the primary VLAN ID related tothe secondary VLAN; sending means 603 configured to send the modifiedfirst frame to the non-PVLAN device connected to the PVLAN switch portcorresponding to the first frame.

According to an embodiment of the present invention, the PVLAN switchfurther comprises: storing means (not shown in FIG. 6) configured tostore the source address of the first frame, the secondary VLAN ID andits related primary VLAN ID, and the PVLAN switch port ID correspondingto the first frame.

According to an embodiment of the present invention, the receiving means601 is further configured to receive a second frame on the promiscuousport sent by the non-PVLAN device connected to the promiscuous port; inresponse to that the second frame comprises a primary VLAN ID, the PVLANswitch port ID corresponding to the second frame and the secondary VLANID related to the primary VLAN ID can be obtained based on thedestination address of the second frame, and the PVLAN switch portcorresponding to the second frame is one of: a promiscuous port; and asmart PVLAN trunk port; the modifying means 602 is further configured tomodify the primary VLAN ID in the second frame into a secondary VLAN IDrelated to the second frame; the sending means 603 is further configuredto send the modified second frame to the non-PVLAN device connected tothe PVLAN switch port corresponding to the second frame from the PVLANswitch port corresponding to the second frame.

According to an embodiment of the present invention, the storing deviceis further configured to store the source address of the frame of theprimary VLAN ID of the second frame, the primary VLAN ID and its relatedsecondary VLAN ID, and the PVLAN switch port ID corresponding to thesecond frame.

According to an embodiment of the present invention, the PVLAN switchfurther comprises: default entry processing means (not shown in FIG. 6)configured to, in response to that the first frame comprises a secondaryVLAN ID and the primary VLAN ID related to the secondary VLAN ID cannotbe obtained based on the destination address of the first frame, use adefault entry to process.

According to an embodiment of the present invention, the default entryprocessing mean is further configured to, in response to that the secondframe comprises the primary VLAN ID and the secondary VLAN ID related tothe primary VLAN ID cannot be obtained based on the destination addressof the second frame, use a default entry to process.

According to an embodiment of the present invention, the default entryprocessing means is further configured to, in response to that thereceived frame is a broadcast frame, use a default entry to process,wherein the received frame is one of: a first frame; and a second frame.

According to an embodiment of the present invention, the default entrycomprises a plurality of options, and the default entry processingdevice is further configured to: for each option, generate a copy of theframe, and modify the VLAN ID in the copy into the rewritten VLAN ID inthe corresponding option, and send the modified copy from the PVLANswitch port designated in the corresponding option.

According to the embodiment of the present invention, the non-isolatedport is one of: a promiscuous port; a smart PVLAN trunk port.

Above is described a method and a PVLAN switch according to embodimentsof the present invention. It should be pointed out that the abovedescription is merely exemplary, rather than limitation to the presentinvention. In other embodiments of the present invention, the method mayhave more, less or different steps, and the relationships of sequence,inclusion, function among the steps may be different from that isdescribed; the PVLAN switch may have more, less or different modules,and the relationships of connection, inclusion, function among themodules may be different from that is described.

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, method or computer programproduct. Accordingly, aspects of the present invention may take the formof an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present invention may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readablestorage medium may be, for example, but not limited to, an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,apparatus, or device, or any suitable combination of the foregoing. Morespecific examples (a non-exhaustive list) of the computer readablestorage medium would include the following: an electrical connectionhaving one or more wires, a portable computer diskette, a hard disk, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), an optical fiber,a portable compact disc read-only memory (CD-ROM), an optical storagedevice, a magnetic storage device, or any suitable combination of theforegoing. In the context of this document, a computer readable storagemedium may be any tangible medium that can contain, or store a programfor use by or in connection with an instruction execution system,apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present invention are described below with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

The descriptions of the various embodiments of the present inventionhave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the describedembodiments. The terminology used herein was chosen to best explain theprinciples of the embodiments, the practical application or technicalimprovement over technologies found in the marketplace, or to enableothers of ordinary skill in the art to understand the embodimentsdisclosed herein.

What is claimed is:
 1. A system for connecting a private virtual localarea network PVLAN switch to a non-PVLAN device, the system comprising:a PVLAN switch configured as a primary VLAN that includes at least onepromiscuous port for connecting to non-PVLAN devices, and at least onesmart PVLAN trunk port for connecting non-PVLAN devices; at least twosecondary VLANs related to the primary VLAN, each of the at least twosecondary VLANs including at least the one smart PVLAN trunk port, andthe at least one smart PVLAN trunk port is included in at least twosecondary VLANs; the system operated to perform a method comprising:receiving a first frame on a smart PVLAN trunk port sent from anon-PVLAN device connected to the smart PVLAN trunk port, the firstframe including a destination address and a secondary VLAN ID;identifying, based on the destination address of the first frame, thePVLAN switch port ID corresponding to the first frame, and the primaryVLAN ID related to the secondary VLAN ID; in response to determiningthat the PVLAN switch port corresponding to the first frame is anon-isolated port: modifying the secondary VLAN ID in the first frame tobe the primary VLAN ID related to the secondary VLAN; and sending themodified first frame to another non-PVLAN device connected to the PVLANswitch port corresponding to the first frame from the PVLAN switch portcorresponding to the first frame.
 2. The system of claim 1, wherein themethod further comprises: receiving a second frame on the promiscuousport sent from a non-PVLAN device connected to the promiscuous port, thesecond frame including a destination address and a primary VLAN ID;identifying, based on the destination address of the second frame, thePVLAN switch port ID corresponding to the second frame, and thesecondary VLAN ID related to the primary VLAN ID; in response todetermining that the PVLAN switch port corresponding to the second frameis one of a promiscuous port and a smart PVLAN trunk port: modifying theprimary VLAN ID in the second frame to be a secondary VLAN ID related tothe second frame; and sending the modified second frame to the non-PVLANdevice connected to the PVLAN switch port corresponding to the secondframe from the PVLAN switch port corresponding to the second frame. 3.The system of claim 1, wherein the method further comprises: in responseto determining that the first frame comprises a secondary VLAN ID, andthe primary VLAN ID related to the secondary VLAN ID cannot be obtainedbased on the destination address of the first frame, using a defaultentry to process.
 4. The system of claim 3, wherein the default entrycomprises a plurality of options, and using the default entry to processcomprises: for each option, generating a copy of the first frame,modifying the VLAN ID in the copy to be the rewritten VLAN ID in thecorresponding option, and sending the modified copy from the PVLANswitch port designated in the corresponding option.
 5. The system ofclaim 1, wherein the method further comprises: in response todetermining that the second frame comprises the primary VLAN ID, andthat the secondary VLAN ID related to the primary VLAN ID cannot beobtained based on the destination address of the second frame, using adefault entry to process.
 6. The system of claim 5, wherein the defaultentry comprises a plurality of options, and the using the default entryto process comprises: for each option, generating a copy of the secondframe, modifying the VLAN ID in the copy to be the rewritten VLAN ID inthe corresponding option, and sending the modified copy from the PVLANswitch port designated in the corresponding option.
 7. The system ofclaim 1, wherein the method further comprises: in response todetermining that the received frame is a broadcast frame, using adefault entry to process, wherein the received frame is one of: a firstframe and a second frame.
 8. The system of claim 1, wherein thenon-isolated port is one of: a promiscuous port; and a smart PVLAN trunkport.
 9. A computer program product for connecting a private virtuallocal area network PVLAN switch to a non-PVLAN device, the PVLAN switchconfigured as a primary VLAN that includes at least one promiscuous portfor connecting non-PVLAN devices and at least one smart PVLAN trunk portfor connecting non-PVLAN devices, at least two secondary VLANs arerelated to the primary VLAN, each of the at least two secondary VLANsincluding the at least one smart PVLAN trunk port for connectingnon-PVLAN devices, and the at least one smart PVLAN trunk port isincluded in at least two secondary VLANs, the computer program productcomprising: one or more non-transitory computer-readable tangiblestorage media and program instructions stored on at least one of the oneor more non-transitory computer-readable tangible storage media, theprogram instructions, when executed by the PVLAN switch and the at leasttwo secondary VLANs, causing the PVLAN switch and the at least twosecondary VLANs to perform a method comprising: receiving a first frameon a smart PVLAN trunk port sent from a non-PVLAN device connected tothe smart PVLAN trunk port, the first frame including a destinationaddress and a secondary VLAN ID; identifying, based on the destinationaddress of the first frame, the PVLAN switch port ID corresponding tothe first frame, and the primary VLAN ID related to the secondary VLANID; in response to determining that the PVLAN switch port correspondingto the first frame is a non-isolated port: modifying the secondary VLANID in the first frame to be the primary VLAN ID related to the secondaryVLAN; and sending the modified first frame to another non-PVLAN deviceconnected to the PVLAN switch port corresponding to the first frame fromthe PVLAN switch port corresponding to the first frame.
 10. The computerprogram product of claim 9, wherein the method further comprises:receiving a second frame on the promiscuous port sent from a non-PVLANdevice connected to the promiscuous port, the second frame including adestination address and a primary VLAN ID; identifying, based on thedestination address of the second frame, the PVLAN switch port IDcorresponding to the second frame, and the secondary VLAN ID related tothe primary VLAN ID; in response to determining that the PVLAN switchport corresponding to the second frame is one of a promiscuous port anda smart PVLAN trunk port: modifying the primary VLAN ID in the secondframe to be a secondary VLAN ID related to the second frame; and sendingthe modified second frame to the non-PVLAN device connected to the PVLANswitch port corresponding to the second frame from the PVLAN switch portcorresponding to the second frame.
 11. The computer program product ofclaim 9, wherein the method further comprises: in response todetermining that the first frame comprises a secondary VLAN ID, and theprimary VLAN ID related to the secondary VLAN ID cannot be obtainedbased on the destination address of the first frame, using a defaultentry to process.
 12. The computer program product of claim 11, whereinthe default entry comprises a plurality of options, and using thedefault entry to process comprises: for each option, generating a copyof the first frame, modifying the VLAN ID in the copy to be therewritten VLAN ID in the corresponding option, and sending the modifiedcopy from the PVLAN switch port designated in the corresponding option.13. The computer program product of claim 9, wherein the method furthercomprises: in response to determining that the second frame comprisesthe primary VLAN ID, and that the secondary VLAN ID related to theprimary VLAN ID cannot be obtained based on the destination address ofthe second frame, using a default entry to process.
 14. The computerprogram product of claim 13, wherein the default entry comprises aplurality of options, and the using the default entry to processcomprises: for each option, generating a copy of the second frame,modifying the VLAN ID in the copy to be the rewritten VLAN ID in thecorresponding option, and sending the modified copy from the PVLANswitch port designated in the corresponding option.
 15. The computerprogram product of claim 9, wherein the method further comprises: inresponse to determining that the received frame is a broadcast frame,using a default entry to process, wherein the received frame is one of:a first frame and a second frame.
 16. The computer program product ofclaim 9, wherein the non-isolated port is one of: a promiscuous port;and a smart PVLAN trunk port.
 17. A system for connecting a privatevirtual local area network PVLAN switch to a non-PVLAN device, thesystem comprising: a PVLAN switch configured as a primary VLAN thatincludes at least one promiscuous port for connecting to non-PVLANdevices, and at least one smart PVLAN trunk port for connectingnon-PVLAN devices; at least two secondary VLANs related to the primaryVLAN, each of the at least two secondary VLANs including at least theone smart PVLAN trunk port, and the at least one smart PVLAN trunk portis included in at least two secondary VLANs; the system operated toperform a method comprising: receiving a frame on the promiscuous portsent from a non-PVLAN device connected to the promiscuous port, theframe including a destination address and a primary VLAN ID;identifying, based on the destination address of the frame, the PVLANswitch port ID corresponding to the frame, and the secondary VLAN IDrelated to the primary VLAN ID; in response to determining that thePVLAN switch port corresponding to the frame is one of a promiscuousport and a smart PVLAN trunk port: modifying the primary VLAN ID in theframe to be a secondary VLAN ID related to the frame; and sending themodified frame to the non-PVLAN device connected to the PVLAN switchport corresponding to the frame from the PVLAN switch port correspondingto the frame.
 18. The system of claim 17, wherein the method furthercomprises: in response to determining that the frame comprises theprimary VLAN ID, and that the secondary VLAN ID related to the primaryVLAN ID cannot be obtained based on the destination address of theframe, using a default entry to process.
 19. The system of claim 18,wherein the default entry comprises a plurality of options, and theusing the default entry to process comprises: for each option,generating a copy of the frame, modifying the VLAN ID in the copy to bethe rewritten VLAN ID in the corresponding option, and sending themodified copy from the PVLAN switch port designated in the correspondingoption.
 20. The system of claim 17, wherein the method furthercomprises: in response to determining that the received frame is abroadcast frame, using a default entry to process.